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Abstract. Visual cryptography schemes have been introduced in 1994 by Naor and 
Shamir. Their idea was to encode a secret image into n shadow images and to give 
exactly one such shadow image to each member of a group P of n persons. Whereas most 
work in recent years has been done concerning the problem of qualified and forbidden 
subsets of P or the question of contrast optimizing, in this paper we study extended 
visual cryptography schemes, i.e. shared secret systems where any subset of P shares its 
own secret. 



1. Introduction 

A visual cryptography scheme is given by the following set up. Let P be a group of n 
persons where each participant is given exactly one image (in fact it does not have to 
be a real image) xeroxed onto a transparency. Stacking all the transparencies together, 
a secret image is recovered. So in this sense the participants share a secret. This set 
up can be generalized to the case where some subsets X C P (which are usually called 
qualified subsets of P) can recover the secret by stacking their transparencies together, 
whereas other, forbidden subsets cannot. Such structures, called access structures, have 
been examined very well. In |S] Naor and Shamir analysed so-called {k, n)-threshold visual 
cryptography schemes, i.e. schemes where a subset is qualified if and only if it consists of 
at least k participants. In ^ and ^ their idea was extended to general access structures. 

Most work concerning this subject focuses on two aspects, either the pixel expansion, i.e. 
the number of subpixels which is needed on the different levels to represent a white or a 
black pixel, or the contrast, i.e. the difference of subpixels representing a white or a black 
pixel. 

As a further generalization, the existence of a secret image can be concealed by displaying 
a different image on each slide. Naor and Shamir _5_ solved this problem for the (2, 2)- 
threshold scheme. In |H] this problem was considered for a general access structure. In 
Droste made a further generalization: Stacking the transparencies of each participant 
together, a secret image is recovered, and there is in fact only this single way to recover it. 
But moreover, the participants of any arbitrary subset A of P share a secret, too. Hence 
we have 2" — 1 more or less secret images. 

We start by briefly recalling the work done by Droste and prove that the scheme proposed 
in 1^ has minimal pixel expansion. Then we prove a trade-off theorem between the contrast 
of the different images. 

Finally we give new constructions for generalized visual cryptography schemes with less 
then 2" — 1 subsets in order to achieve a smaller pixel expansion and a better contrast. 

2. Preliminaries 

A visual cryptography scheme is based on the fact that each pixel of an image is divided 
into a certain number m of subpixels. This number m is called the pixel expansion of the 
image. If the number of black subpixels needed to represent a white pixel in an image is 
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I, and the number of black subpixels needed to represent a black pixel is h, then we call 
the number a = the contrast of the image. 

An extended visual cryptography scheme consists of n transparencies ri , . . . , r„ and 2" — 1 
different images (one for each non-empty subset T C {1, • • • ,n}). We denote by It the 
image which is recovered by stacking together exactly the transparencies Tj for i € T. 
We generalize this as follows. For any non-empty subset & C ^({1, • • • ,n})\{(!)} an 
S-extended visual cryptography scheme consists of n transparencies ri , . . . , r„ with the 
following property: Let T £ &. If we stack together the slides Tj for i £ T, then we 
recover the image It for which each white pixel is represented by It black subpixels and 
each black pixel is represented by /ij- black subpixels. Furthermore, for T' not contained 
in T, the distribution of subpixels on the transparencies Tj with i € T is independent of 
the image It', i.e. the information of the transparencies Tj with i £ T does not suffice to 
recover the image It'- 

More formally, we define an ©-extended visual cryptography scheme as follows. (See also 
[3] for "usual" visual cryptography schemes and 01 for ©-extended visual cryptography 
schemes.) 

Definition 2.1. Let © C r{{l, n})\{0}. 

An &-extended visual cryptography scheme is described by multi-sets C"^ ofnxm Boolean 
matrices for T C ©. (For given T each Boolean matrix in C'^ describes the colors of the 
subpixels on each transparency, where the corresponding pixel in image It is black if and 
only ifT£l.. For encoding, each matrix in C'^ is chosen with the same probability.) 

The multi-sets must satisfy the following conditions: 

(1) Let B G C^. For {ii, . . . ,iq] £ © the Hamming weight of the OR of the rows 
ii,...,ig of B is /i{i,,...,jj if {ii,. . . ,ig} £l and l^i^^ otherwise, i.e. 

if {h, ...,iq}£l 
if{ii, ...,iq}^1 

(This means stacking the transparencies Ti^,... ,Tig together we recover the image 

(2) For {ii,...,iq} C {!,..., n} and T,T' C © with 1 n r{{ii, . . . ,ig}) = 1' n 
■p({ii, . . . , iq}) we obtain the same multi-sets if we restrict the matrices in C'^ 
and C'^' respectively to the rows ii, . . . ,iq. 

(This condition guarantees the security of the different images.) 

If 6 = ^({1, . . . we simply call this an extended visual cryptography scheme. 

In |1] Droste gives the following construction for ©-extended visual cryptography schemes 
using (fc, A;)-threshold schemes. 

Construction 2.2. For each T £ & we take 21"^!^"'^ subpixels and use them to construct a 
(|r|, \T\) -threshold visual cryptography scheme. If i ^ T the corresponding subpixels on ti 
will be black. The & -extended visual cryptography scheme is achieved by putting all these 
schemes together. Since we shall not need the details of this construction in the sequel, we 
omit a formal definition and refer to [1] . 

The scheme obtained by this construction has pixel expansion 

m = ^2l^|-i 

Tee 

and the contrast of all encoded images is ^ . We shall prove in the following sections that 
this construction is optimal if © = V{{1, . . . ,n})\{0} but it is not optimal for general ©. 
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It is sufficient to consider the case of one single pixel. For a given non-empty subset T C 
{1, . . . , n} let XT be the number of subpixels which are black exactly on the transparencies 
i ioT i £ T and let us denote by x the vector of all the xt- For 7^ S" C {1, . . . , n} let 
be the number of black subpixels needed for the image I5. Formally we set r0 = 0. We 
write r for the vector of all the rs with ^ ^ S Q {1, . . . ,n}. 

This leads to the linear equation system given by 



(1) Mx = r 

where M = ims^T)iD^s,Tc{i,...,n} is defined by ms^r = liiSr\T^^ and ms^r = 
otherwise. 

Lemma 3.1. Equation ^\) has a unique integral solution. 



Proof. We prove this by induction on the number n of transparencies. Writing Mi = (1), 
we obtain the following recursion formula which follows directly from the definition: 

/M„ M„\ 
M„+i = 1 1 . 
\M„ 1 1 / 

Here the index denotes the number of transparencies. 

Let e„ denote the (2" — 1) dimensional vector (1, . . . , 1)*. With M^^ = (1) we obtain the 
following recursion formula for M~^: 

( -M-^en M-i \ 
M^l^ = -ef,M-i eiM-^ 

We notice that the components of M~^en are only —1,0 and 1 and that e':^M~^en = 1- 
Then the formula can be proved by induction. 

Thus contains only the entries —1,0 and 1 and therefore equation has an integral 
solution. □ 

Lemma 3.2. The solution of is non-negative if and only if for each S C {1, . . . ,n} 

the condition 

(2) ^ ^-i)\s\+\T\^^ < 

scrc{i,...,n} 

is satisfied. 



Proof. We claim that x = (xs) with 

(3) xs= (-l)l^l+l^l+"+V 

{l,...,n}\5CTC{l,...,n} 

solves equation and due to Lemma l3. II this solution is unique. 
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To prove this we substitute x in equation (^. For 7^ C/ C {1, . . . ,n} the hne of the 
system of hnear equations corresponding to U yields 

E mu,sxs= E mu,s Yl (-1)I^I+I^I+"+Vt 

07^5C{l,...,n} SC{l,...,n} {l,...,n}\5CrC{l,...,r!,} 

(4) = E E (-i)i^i^i^i^"^v^m^,, 

TC{l,...,n} {l,...,n}\rC5C{l,...,n} 
9^TC{l,...,n} {l,...,n}\TCSC{l,...,n} 

If T 2 [/ we choose t G T\C/ and obtain 

{l,...,n}\rC5C{l,...,n} 

{!,... ,n}\{TU{t}}C5C{l,...,n}\{i} 

since m[7,5 = m[/^5u{t}. 

If T C [/ and T / we find 

y: (-i)|"|+"+w= e (-1)1^1+-+^ = 

{l,...,n}\TC5C{l,...,n} {l,...,n}\TC5C{l,...,n} 

since m;7^5 = 1. 

But for / r = we find 

^ (-l)l^l+"+lm[;,5 = J] (_iy5|+n+l _ (_-L)|{l,...,n}W|+„+l 

{l,...,n}\rC5C{l,...,n} {l,...,n}\TC5C{l,...,n} 

^ ^_-^y{l,...,n}\C7|+n 

since m[7^5 = 1 for 5 7^ {1, ... , n}\U. 
Thus equation (0]) yields 

E rnu,sxs= Y (-1)"^'^^ E {-lf^^''^'rnu,s 

(Dj^SC{l,...,n} 05^rC{l,...,n} {l,...,n}\TC5C{l,...,n} 

= (_l)|t/|^^(_l)l{l,...,n}WI+n 

This proves that x is a solution of equation and the lemma follows. □ 

Now we can solve (jSJ to derive bounds for the pixel expansion and the contrast. 

Theorem 3.3. An extended visual cryptography scheme with n transparencies needs at 
least ^(3" — 1) subpixels. Hence Construction is optimal with respect to the pixel 
expansion. 

Proof. First we note that the inequality is as strong as possible if rT = hx for [S"] + |T| 
even and r-p = Ij- for \S\ + \T\ odd. 
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Thus an extended visual cryptography scheme exists if and only if 

(5) Yl 

SCrC{l,...,n} 5CTC{l,...,n} 
|5| = |T1 mod 2 |S|^|T| mod 2 

holds for each 5" C {1, . . . , n\. 

For each / T C {1, . . . , n} let (5^ = /i^ — It- Our goal is to prove that 

(6) m > > -^^^^I^l-i . 

05^TC{l,...,n} 

As the first step in this proof we show that, for given values 5t (for 7^ T C {1, . . . , n}), 
the number /i{i,...,n} is minimal if for all S C {1,... ,n} inequality Q is satisfied with 
equality. 

To this end, suppose 

Y Y 

SQTQ{l,...,n} SCTC{l,...,n} 
|S| = |T| mod 2 ISI^ITI mod 2 

for some C {1, . . . , n}. But the contrast levels 

JiT - 



hx for T C S 
/iT — 1 otherwise 



and 



It 



It for T C 5 
It — 1 otherwise 



satisfy ©, since 



|{r I 5 C r C {1,... ,n}; [r| = \S\ mod 2;T 2 5}| = 

|{r|5CTC{l,...,n};|T|^|5| mod2;TgS}\ . 

Thus we may assume that inequality ^ is satisfied with equality for each 5* C {1, . . . , n}. 
Next we claim that 

(7) hT= Y '5t'2I^'I-1- Y 

07^T'C{l,...,n} TCT'C{l,...,n} 

for / 5 C {1, . . . , n} satisfy © with equality. 
To prove this we have to show that 



E 



SQTC{l,...,n} 

\S\ = \T\ mod 2 



Y 5t'2\^'^-'- Y '5t'2I^'1-i-I^1 

0^T'C{l,...,n} rCT'C{l,...,n} 



E 



SCTCjl,...,/!} 
|S|^|T| mod 2 



07^T'C{l,...,n} TCT'C{l,...,n} 
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or equivalently 

05^T'C{l,...,n} 



E 



,|r'|-i 



|r'|-i-|T| 



SCTC{l,...,n} 
.\S\ = \T\ mod 2 



SCTCT' 
\S\ = \T\ "mod 2 



0^T'C{l,...,n} 



SCTC{l,...,n} 
\S\^\T\ mod 2 



SCTCT' 
\S\^\T\ "mod 2 



(_l)|T'| + |5|_i 



(Note that the last summand is equal to —5t' for \T'\ ^ \S\ mod 2 and equal to 
otherwise.) 

Comparing coefficients for each 6t' we obtain 



2\T'\-1-\T\ 



SCTCT' 
\S\ = \T\ "mod 2 



2\T'hl-\T\ 



1 SCTCT' 
\\S\^\T\ "mod 2 



+ 



but this is true since 

(-1)I^'I-|5U(1_2)|T'|~|5| 



J2 2\^'\-m _ Y 2f^'i-i^i 



SCTCT' 
[T'l^lTI mod 2 



5CTCT' 
|T'|^|T| mod 2 



Suppose that /it (for 7^ T C {l,...,n}) satisfy © with equality, too. For 5 7^ 
inequality © gives 

hs = hs + /i{l,...,n} - ^{l,...,n}- 

But for 5" = inequality © yields /iji „} = „} and therefore fix = /it for all 

This proves that (O is the only solution of © that satisfies all inequalities with equality. 
Thus we find 



07^T'C{l,...,n} 



07^T'C{l,...,n} 



□ 



Next we prove a trade-off between the contrast of the different images. 



Ht—Ii 



he the contrast of the image It- 



Theorem 3.4. For / T C {1, . . . , n} let ar 

The contrast levels of the images satisfy 

(8) E 2l^'"'"T<l . 

0^TC{l,...,n} 

Further let a'rp > (for 07^TC{l,...,n}J satisfy Q . Then for every e > there exists 
a generalized visual cryptography scheme with contrast levels ax (for 07^TC 
where \aT — a^I < e for nonempty subsets T of {1, ... ,n}. 
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Proof. Let 6t = hx — It- By ((TJ we conclude 



07^TC{l,...,n} 



and therefore 



05>^TC{l,...,n} 0^TC{l,...,n} 

Now assume Q holds for a'rp. Then we choose 5t and Af E N with 

- ^ M - 

By we know that there exists an extended visual cryptography scheme with contrast 
levels hx — It = ^T and minimal pixel expansion 

d^TC{l,...,n} 

Since ^ < and ot' satisfy we find m < M. 

If we add useless subpixels (e.g. subpixels that are always black) to the extended visual 
cryptography scheme constructed above, we obtain a scheme with contrast ot = This 
proves the theorem. □ 

4. Pixel Expansion and Contrast for the ©-Extended Scheme 

In the previous section we proved that Construction l2 . 2l is optimal if 6 = P({1, . . . , n})\{$}. 

If we set = 1 for T € 6 and 6t = for T ^ 6 in equation ((Jj) we obtain the same 
contrast values as in Construction 12.21 In this sense Construction 12.21 can be viewed 
as a (V{{1, . . . , n})\{0})-extended visual cryptography scheme with degenerated contrast 
values. 

Theorem 4.1. Let 6 = V{{1, . . . , n})\{0, {!,..., n}} then Construction \2. gl is optimal if 
and only if n is odd. 

Proof. Let (5t = 1 for ^ T C {1, . . . , n} and 6^i^ n} = 0- Then Iit and It = Ht — St as 
in ((TJ satisfy © and these are the solutions given bv 12.21 

Let us assume n is even. We show that in this case we can find a better construction 
in the sense that fewer subpixels are required. Setting hT = fiT — I and It = It — ^ for 
^ r C {1, . . . , n} and /i0 = I0 = we observe that inequality Q still holds for all 5 7^ 0. 
Thus the solution x = {xT)QjtTc{i,...,n} of equation (Q) satisfies xt > for T 7^ {1, . . . , n}. 

The value of X{i will be non-negative unless = Iit for |r| even and = It for 
|rl odd. In this special case equation Q gives the solution Xj^^ „} = —1. To obtain a 
solution with positive x^i^ we adjust the value of r^i^ from to /i{i,...,n} ~ 1- 

(This is possible, since {1, . . . , n} S which means that the number of black subpixels in 
the stack of all transparencies does not matter.) Now ^ reveals the solution 

^{l,...,n}= E (-l)'^'^'-T 

rc{i,...,n} 



E '^T 



TC{l,...,n} 

\T\ odd \ |T| even 



E 

, TC{l,...,n} , 
\ ITI even / 



+ 1 = -1 + 1 = 0. 
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For S ^ {1, . . . ,n} and |5| even we obtain 

xs= Yl (-i)I^i+i^i+-+Vt 

{l,...,n}\5CTC{l,...,n} 

/ 



E 



{l,...,n}\SCTC{l,...,n} 
\T\ odd 



{l,...,n}\SCTC{l,...,n} 
\T\ even 



+ 1 = + 1 = 1. 



For \S\ odd we obtain 



xs= J2 (-l)l^l+l^l+-+Vr 

{l,...,n}\SCrC{l,...,n} 



E 



{l,...,n}\SQTC{l,...,n} 
\ \T\ even 



1 



> 



E 



{l,...,n}\SCTC{l,...,n} 
\T\ even 



E 

1 



{l,...,n}\S'CTC{l,...,n} 
|T| odd 



E 



1 = -1. 



{l,...,n}\SCTC{l,...,n} , 
\T\ odd / 



Thus all possible values of r lead to non-negative solutions for x, hence an S-extended 
visual cryptography scheme with m = < /i{i,...,n} exists, i.e. the solution given by 

12.21 is not optimal. 

Now we assume n is odd. Let hr and It (0 7^ T C {1, . . . , n})) be a solution of (jSJ different 
from hx and It- Let /i{i,...,n} be the maximal number of black subpixels occurring when 
all the transparencies are stacked together. 

Since and It solve inequality we can apply the same arguments leading from (0) 
to and find 

(9) -hT> ^{l,...,n} - hT 

for all 7^ r C {1, ... , n}. But for 5 = in ©, we obtain 

hT< 

TC{l,...,n} rc{l,...,n} 
|r| even |T| odd 

and hence, together with ©, 

'{l,...,n} > ^{l,...,n} = ^{l,...,n}- 

But by definition ^ ^{i,...,n} ^'^d therefore this solution needs at least ^{i,...,n} 

subpixels, i.e. the solution given bv 12.21 is optimal. □ 

We notice that in the first part of the proof of l4.1l we did not need the assumption 5t = ^ 
for / T C {1, . . . , n}. In fact, it is sufficient to assume /it / where Ht is defined by 
((TJ. A short calculation proves that this is the case if © ^ 'P{S) for a proper subset 5* of 
{1, . . . , re}. Thus the first part of 14. II proves: 

Corollary 4.2. For & C ^({1, . . . , n})\{0, {1, . . . , n}}, & ^ S for any proper subset S of 
{1, . . . , re} and re even, Construction \2.^ is not optimal. 
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Even more general we can prove: 

Theorem 4.3. Let & C V{{1, . . . ,n})\{0}. Let us assume that there exists a nonempty 
subset T G ^{{1, . . . ,n})\& with \T\ even and that & D V{T) ^ V(T') for each proper 
subset T' ofT. Then Construction \2.^ is not optimal. 



Proof. We apply 1^21 to & fl V{T). For a proper subset T' of T we define hx' and It' as 
in the proof of 14.11 Formally we define Ht = — 2 and It = hx — ^ where Ht is defined 
by 0. Let 5t = -1 and for T / 5 C {1, . . . , n} we define 5^ = for 5 6 and 5s = 1 
otherwise. 

Corresponding to we define 

7t+ E 5s'2\s'\-^- Z <55'2l^'l-i-l^l forS^T 

0^S"C{l,...,n} 5CS'C{l,...,n} 
S'gT 

J2 6s'2\^'^-'- E <55'2l^'l-i-l^l former 

05^5'C{l,...,n} 5CS'C{l,...,n} 
S"gT S'gT 

for / 5 C {1, . . . , n} and Is = hs — 5s- 

An easy but tedious calculation corresponding to the one that was used in the proof of 
Theorem 13.31 shows that hs,ls satisfy ©. Hence an S-extended visual cryptography 
system with contrast levels hs,ls exists. This scheme has a smaller pixel-expansion than 
the scheme given by Construction □ 



5. Conclusions and further remarks 



Equation Q gives us a simple method to construct an S-extended visual cryptography 
scheme with given contrast values It and Ht- Furthermore, for fixed n and S, equation Q 
leads to a linear programming problem which describes all possible S-extended visual 
cryptography schemes. For small values of n this problem can easily be solved. 

In this article we have given a full solution for the special cases S = ^({1, • • • , n})\{^} and 
S = V{{1, . . . , n})\{0, {1, . . . , n}}. We close by presenting the following open problems: 

(1) We conjecture: 

Let S C V{{1, . . . ,n})\{(l}}. Then Construction 12.21 is optimal for an 
S-extended visual cryptography scheme if and only if for all ^ T S 
we have either |T| odd or S U V{T) C ViT') for some proper subset T' 
of T. 

(2) An even harder problem is a full characterization of S-extended visual cryptogra- 
phy schemes with minimal pixel expansion for arbitrary subsets S of V{{1, . . . , n}), 
i.e. to find a formula for the minimal pixel expansion depending on S. 
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